Add DEV R2 project asset storage contract - PR_26167_200-r2-project-assets-dev-storage

Author: ToolboxAid

docs_build/dev/PROJECT_INSTRUCTIONS.md

@@ -350,6 +350,60 @@ Rules:
 - Local session state must resolve selected users and roles from persisted Memory DB `users`, `roles`, and `user_roles` records.
 - Missing users or roles must fail visibly with actionable diagnostics.
 
+## ENVIRONMENT CONFIGURATION GOVERNANCE
+
+Runtime startup loads `.env` only.
+
+The following files are copy-source files only:
+- `.env.dev`
+- `.env.ist`
+- `.env.uat`
+- `.env.prd`
+
+Valid deployment targets are:
+- `DEV`
+- `IST`
+- `UAT`
+- `PRD`
+
+Manual deployment-target flow:
+1. Copy the selected `.env.<target>` file to `.env`.
+2. Run validation.
+3. Apply DDL/DML migrations.
+4. Start runtime.
+
+Runtime environment parameters are prohibited.
+
+Do not introduce runtime parameters such as:
+- `--env`
+- `--environment`
+- `ENVIRONMENT=DEV`
+- `ENVIRONMENT=UAT`
+- `ENVIRONMENT=PRD`
+
+`DEV`, `IST`, `UAT`, and `PRD` are deployment targets, not application behaviors.
+
+Application code, runtime code, API/service code, and DB runtime scripts must not branch behavior by deployment target name.
+
+## RUNTIME SCRIPT NAMING GOVERNANCE
+
+Active runtime script names should describe capability rather than vendor/provider.
+
+Preferred runtime naming nouns are:
+- `auth`
+- `database`
+- `storage`
+- `telemetry`
+- `api`
+
+Avoid provider or vendor names in future active runtime script names.
+
+When an active script is renamed, a temporary compatibility wrapper may remain only when needed for command continuity.
+
+Compatibility wrappers must log:
+
+`Deprecated script name. Use <new-name>.`
+
 ## ARCHIVED V1/V2 REFERENCE MATERIAL
 
 Deprecated V1/V2 reference material lives under:

docs_build/dev/admin-notes/index.txt

@@ -2,20 +2,25 @@
 [.] Start the server
 npm run dev:local-api
 
+[x] Deploy DEV, IST, UAT, PRD
+node .\scripts\validate-supabase-dev.mjs
+node .\scripts\apply-supabase-dev-ddl.mjs
+node .\scripts\validate-supabase-dev.mjs
+npm run dev:local-api
+
+[x] Users/PSWD
 - Update DEV Supabase identity seed so only these test identities remain:
   - User 1, email user1@example.invalid, password GFS1
   - User 2, email user2@example.invalid, password GFS2
   - User 3, email user3@example.invalid, password GFS3
   - DavidQ, email qbytes.dq@gmail.com, password GFS$2026
-  
+   
 [x] move 
 src\assets\fonts\0xProtoNerdFont\ to assets\theme-v2\fonts\
 src\assets\fonts\vector_battle\ to assets\theme-v2\fonts\
 delete src\assets\
 
 
-
-
 # Admin Notes Ownership
 
 Admin Notes are dev-only documentation artifacts.

docs_build/dev/reports/PR_26167_199-env-copy-source-governance.md

@@ -0,0 +1,76 @@
+# PR_26167_199-env-copy-source-governance
+
+Status: PASS with unrelated worktree note
+
+## Branch Validation
+- PASS: Current branch is `main`.
+- Expected branch: `main`.
+
+## Summary
+- Added targeted Project Instructions governance for `.env` runtime loading, copy-source env files, deployment targets, and script naming.
+- Added vendor-neutral active script names:
+  - `scripts/validate-runtime-connections.mjs`
+  - `scripts/apply-database-ddl.mjs`
+- Kept compatibility wrappers for the old script names with the required deprecation messages.
+
+## Requirement Checklist
+- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
+- PASS: Hard-stop branch check passed on `main`.
+- PASS: Documented that runtime loads `.env` only.
+- PASS: Documented `.env.dev`, `.env.ist`, `.env.uat`, and `.env.prd` as copy-source files only.
+- PASS: Documented manual flow: copy selected target file to `.env`, run validation, apply DDL/DML migrations, start runtime.
+- PASS: Documented valid deployment targets: `DEV`, `IST`, `UAT`, `PRD`.
+- PASS: Prohibited runtime environment parameters including `--env`, `--environment`, `ENVIRONMENT=DEV`, `ENVIRONMENT=UAT`, and `ENVIRONMENT=PRD`.
+- PASS: Stated that deployment targets are not application behaviors.
+- PASS: Added script naming governance.
+- PASS: Added preferred naming nouns: `auth`, `database`, `storage`, `telemetry`, `api`.
+- PASS: Documented avoidance of provider/vendor names in future active runtime script names.
+- PASS: Renamed `scripts/validate-supabase-dev.mjs` to `scripts/validate-runtime-connections.mjs`.
+- PASS: Renamed `scripts/apply-supabase-dev-ddl.mjs` to `scripts/apply-database-ddl.mjs`.
+- PASS: Kept compatibility wrapper `scripts/validate-supabase-dev.mjs`.
+- PASS: Kept compatibility wrapper `scripts/apply-supabase-dev-ddl.mjs`.
+- PASS: Wrapper output includes `Deprecated script name. Use validate-runtime-connections.mjs.`
+- PASS: Wrapper output includes `Deprecated script name. Use apply-database-ddl.mjs.`
+
+## Script Rename Mapping
+- `scripts/validate-supabase-dev.mjs` -> `scripts/validate-runtime-connections.mjs`.
+- `scripts/apply-supabase-dev-ddl.mjs` -> `scripts/apply-database-ddl.mjs`.
+- Added npm alias: `validate:runtime-connections`.
+- Kept npm compatibility alias: `validate:supabase-dev`.
+
+## Validation Lane Report
+- PASS: `node --check scripts\validate-runtime-connections.mjs`.
+- PASS: `node --check scripts\apply-database-ddl.mjs`.
+- PASS: `node --check scripts\validate-supabase-dev.mjs`.
+- PASS: `node --check scripts\apply-supabase-dev-ddl.mjs`.
+- PASS: `node -e` package JSON parse.
+- PASS: docs/static governance assertion over `docs_build/dev/PROJECT_INSTRUCTIONS.md`.
+- PASS: `node --use-system-ca .\scripts\validate-runtime-connections.mjs`.
+- PASS: `node .\scripts\apply-database-ddl.mjs`.
+- PASS: `node --use-system-ca .\scripts\validate-supabase-dev.mjs`.
+- PASS: `node .\scripts\apply-supabase-dev-ddl.mjs`.
+- PASS: `npm run validate:runtime-connections`.
+- WARN: Full-worktree `git diff --check` failed on pre-existing unrelated `docs_build/dev/admin-notes/index.txt` trailing whitespace.
+- PASS: Scoped PR199 `git diff --check -- docs_build\dev\PROJECT_INSTRUCTIONS.md package.json scripts\validate-runtime-connections.mjs scripts\apply-database-ddl.mjs scripts\validate-supabase-dev.mjs scripts\apply-supabase-dev-ddl.mjs`.
+- SKIP: Playwright; not required because this PR changes docs/governance and script naming only.
+- SKIP: Full samples smoke; not in scope.
+
+## Manual Validation Notes
+- New validator script executed successfully and returned `Overall Result: PASS`.
+- New DDL script executed successfully and applied 15 grouped DDL files.
+- Compatibility wrappers executed successfully and printed the required deprecation messages before running the new scripts.
+- Existing unrelated worktree change `docs_build/dev/admin-notes/index.txt` was not modified or packaged.
+
+## Artifact Output
+- PASS: Repo-structured ZIP created at `tmp/PR_26167_199-env-copy-source-governance_delta.zip`.
+
+## Changed Files
+- `docs_build/dev/PROJECT_INSTRUCTIONS.md`
+- `package.json`
+- `scripts/validate-runtime-connections.mjs`
+- `scripts/apply-database-ddl.mjs`
+- `scripts/validate-supabase-dev.mjs`
+- `scripts/apply-supabase-dev-ddl.mjs`
+- `docs_build/dev/reports/PR_26167_199-env-copy-source-governance.md`
+- `docs_build/dev/reports/codex_review.diff`
+- `docs_build/dev/reports/codex_changed_files.txt`

docs_build/dev/reports/codex_changed_files.txt

@@ -1,9 +1,9 @@
-.env.example
-scripts/apply-supabase-dev-ddl.mjs
-scripts/start-local-api-server.mjs
+docs_build/dev/PROJECT_INSTRUCTIONS.md
+package.json
+scripts/validate-runtime-connections.mjs
+scripts/apply-database-ddl.mjs
 scripts/validate-supabase-dev.mjs
-src/dev-runtime/auth/provider-contract-stubs.mjs
-src/dev-runtime/persistence/postgres-connection-client.mjs
-docs_build/dev/reports/PR_26167_198-database-ssl-mode-contract.md
+scripts/apply-supabase-dev-ddl.mjs
+docs_build/dev/reports/PR_26167_199-env-copy-source-governance.md
 docs_build/dev/reports/codex_review.diff
 docs_build/dev/reports/codex_changed_files.txt